fix(web): prevent silent opening mutation repeats - #646

Summary

• Separate bounded mutation execution authority (in-flight, succeeded, failed-unknown) from the 64-entry opening-result cache.
• Keep in-flight calls authoritative under result-cache pressure and never automatically retry succeeded-without-result or failed/unknown mutations.
• Show a persistent host warning and error result directing the user to run the tool explicitly from the App.
• Keep readOnlyHint: true opening tools live on every page load and document the policy in English and Chinese.

Chosen model

Bounded execution tombstones separate from cached results. This preserves the existing automatic opening experience for the first call while removing silent repeat authority; rejecting every automatic mutation opening would be a materially broader behavior break. The execution ledger is capped at 256 and fails closed when full, while results remain independently capped at 64.

Tests

• TDD red: 3 failures reproduced completed-result eviction, in-flight eviction pressure, and failed-after-side-effect retry.
• pnpm build
• pnpm typecheck
• pnpm lint
• pnpm test:unit — 4,148 passed, 6 skipped
• focused web-host/web-launch/MCP-session suite — 73 passed
• pnpm docs:site:build — locale parity and 0 broken links

Deslop

GPT-5.6 Sol, 1 edit — promoted the fail-closed warning from result-only text to an explicit host-visible status so an interactive App cannot hide the safety state.

Self-review

Reviewer: claude-fable-5-1-thinking-high (change-risk-reviewer) over 90b411b0d vs origin/main.

Findings and dispositions:

1. Medium — leased retired sessions could leak execution records into the 256-entry cap. Fixed in 0a26c5979: the route-owned close watcher now remains subscribed until actual session close, and the session test double exercises close notifications. A 257-retirement regression test proves records are reclaimed after the final page lease releases.
2. Low — the execution-cap branch lacked coverage. Fixed: a 257th distinct mutation key is suppressed with the host-visible explicit-run notice and no tool call.
3. Low — #unavailableOpeningCall returned the narrower base type. Fixed: it now returns WebOpeningCall directly.
4. Low residual — a close race can leave at most one failed tombstone for a request already past session lookup. Dismissed: it remains fail-closed, requires a narrow close/request race, and cannot authorize a repeat; the bounded ledger limits impact.

Second review at 0a26c5979: no merge-blocking risks. One low stale-session replacement race was fixed in 8a44043d5 by checking the resolved session id and current map promise before deleting; its regression test proves the replacement remains registered for later retirement. One low dead-session close race was dismissed: it can consume at most one bounded fail-closed slot per narrow rebuild/request race and cannot authorize a repeat.

Final review at 8a44043d5: no concrete merge risks found. The async close guard cannot skip a closed current session or delete a replacement and is safe with epoch adoption and route shutdown. Two low residuals were dismissed: a close-time microtask window can produce one fail-closed 502 without reaching mutation execution, and direct external-close guard coverage is optional because the replacement and 257-retirement tests exercise both identity and cleanup invariants.

Post-main-merge review at 37e6e6e78: no concrete merge risks; the merged main delta is disjoint and all authority, lifecycle, warning, docs, and changeset invariants remain intact. The previously dismissed one-request fail-closed 502 microtask window is unchanged.

Auto-merge remains unarmed until latest-head CI and threads are green.